CVE-2021-43712

47th percentile - higher than 47% of all known CVEs

A stored XSS vulnerability was found in the Add New Employee form of Sourcecodester Employee Daily Task Management System 1.0. A remote attacker can inject and store arbitrary JavaScript code via the Name field, which executes when the data is viewed.

The risk includes session hijacking, redirection to malicious sites, or theft of administrator credentials. This could lead to account takeover and privilege escalation within the system.

Immediately update the system to the latest version or implement input filtering (validation and HTML encoding) for the Name field. Additionally, deploy a Content Security Policy (CSP) to restrict script execution.